The user has a different active recovery key. Only a rotation replaces it (docs/recovery-key-lifecycle.md).